Changeset 432

Show
Ignore:
Timestamp:
03/27/06 00:09:08 (3 years ago)
Author:
common
Message:

shellcode-signatures
- added namespace linkxor::
- added namespace connectbackfiletransfer:: (handles csend:// and link:// downloads )
- fixed some mappings
- moved some signatures to other namespaces ( connectbacklinkfiletransfer -> connectbackfiletransfer )

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • nepenthes/trunk/modules/shellcode-signatures/Makefile.am

    r429 r432  
    2020shellcodesignatures_la_SOURCES += sch_namespace_execute.cpp sch_namespace_execute.hpp 
    2121shellcodesignatures_la_SOURCES += sch_namespace_url.cpp sch_namespace_url.hpp 
     22shellcodesignatures_la_SOURCES += sch_namespace_linkxor.cpp sch_namespace_linkxor.hpp 
     23shellcodesignatures_la_SOURCES += sch_namespace_connectbackfiletransfer.cpp sch_namespace_connectbackfiletransfer.hpp 
    2224 
    2325shellcodesignatures_la_LDFLAGS = -module -no-undefined -avoid-version 

  • nepenthes/trunk/modules/shellcode-signatures/shellcode-signatures.cpp

    r429 r432  
    4444#include "sch_namespace_execute.hpp" 
    4545#include "sch_namespace_url.hpp" 
     46#include "sch_namespace_linkxor.hpp" 
     47#include "sch_namespace_connectbackfiletransfer.hpp" 
    4648 
    4749#include "ShellcodeManager.hpp" 
    …… 
    134136 
    135137                case sc_linkxor: 
     138                        sch = new NamespaceLinkXOR(sc); 
    136139                        break; 
    137140 
    …… 
    147150 
    148151                case sc_connectbackfiletransfer: 
     152                        sch = new NamespaceConnectbackFiletransfer(sc); 
    149153                        break; 
    150154 

  • nepenthes/trunk/modules/shellcode-signatures/shellcode-signatures.sc

    r430 r432  
    66[n] [+]   1) GenericCreateProcess generic CreateProcess decoder 
    77[n] [+]   2) GenericUrl generic Url decoder 
    8 [+] [ ]   3) LinkXOR  link-bot XOR decoder 
     8[n] [+]   3) LinkXOR  link-bot XOR decoder 
    99[n] [+]   4) GenericCMD generic CMD decoder 
    10 [+] [ ]   5) LinkTrans handles linkbot/linkshellcode connectback transfers 
     10[n] [+]   5) LinkTrans handles linkbot/linkshellcode connectback transfers 
    1111[+] [ ]   6) LinkBindTrans handles linkbot/linkshellcode bind transfers 
    12 [+] [ ]   7) Stuttgart handles "stuttgart" shellcode 
     12[n] [+]   7) Stuttgart handles "stuttgart" shellcode 
    1313[s] [ ]   8) Wuerzburg handles "wuerzburg" shellcode 
    1414[n] [+]   9) GenericBind various bindshells 
    1515[n] [+]   10) GenericConnect various bindshells 
    1616[n] [ ]   11) KonstanzXOR Konstanz XOR decoder 
    17 [n] [ ]   12) GenericConnectTrans various csends 
     17[n] [+]   12) GenericConnectTrans various csends 
    1818[?] [ ]   13) GenericUniCode generic UniCode decoder 
    1919[n] [+]   14) GenericWinExec generic WinExec decoder 
    …… 
    2222[?] [ ]   17) ASN1IISBase64 handles oc192 dcom bindshell 
    2323[a] [ ]   18) ASN1SMBBind handles oc192 dcom bindshell 
    24 [s] [ ]   19) THCConnect handles thc iis connectbackshells 
    25 [a] [ ]   20) THCBind  handles thc iis bindshells 
    26 [s] [ ]   21) HODBind  handles oc192 dcom bindshell 
    27 [s] [ ]   22) HODConnect handles oc192 dcom bindshell 
    28 [s] [ ]   23) HODBind  handles house of dabus msmq bindshells 
    29 [a] [ ]   24) HODBind  handles house of dabus netdde bindshells 
    30 [a] [ ]   25) HODConnect handles house of dabus netdde bindshells 
    31 [s] [ ]   26) MandragoreBind mandragore sasserftpd bondshells 
    32 [s] [ ]   27) MandragoreConnect mandragore sasserftpd bondshells 
     24[n] [+]   19) THCConnect handles thc iis connectbackshells 
     25[ ] [ ]   20) THCBind  handles thc iis bindshells 
     26[n] [+]   21) HODBind  handles oc192 dcom bindshell 
     27[n] [+]   22) HODConnect handles oc192 dcom bindshell 
     28[n] [+]   23) HODBind  handles house of dabus msmq bindshells 
     29[n] [+]   24) HODBind  handles house of dabus netdde bindshells 
     30[n] [+]   25) HODConnect handles house of dabus netdde bindshells 
     31[n] [+]   26) MandragoreBind mandragore sasserftpd bondshells 
     32[n] [+]   27) MandragoreConnect mandragore sasserftpd bondshells 
    3333[n] [+]   28) HATSQUADConnect handles hat-squad wins connect 
    3434[n] [+]   29) HATSQUADBind handles hat-squad wins bindshell 
    35 [s] [ ]   30) ZUCConnect handles zuc wins connect 
     35[+] [+]   30) ZUCConnect handles zuc wins connect ( dupe of 19)) 
    3636   =--- 31 ShellcodeHandlers registerd   
     37 
    3738*/ 
    3839 
    …… 
    178179}; 
    179180 
     181/* 
     182 * too inaccurate 
     183 *  
    180184xor::mwcollect 
    181185{ 
    …… 
    184188        mapping (none,pre,pcre,size,key,post); 
    185189}; 
    186  
     190*/ 
    187191 
    188192xor::hod 
    …… 
    211215        pattern 
    212216        "\\xEB\\x15\\xB9(....)\\x81\\xF1(....)\\x5E\\x80\\x74\\x31\\xFF(.)\\xE2\\xF9\\xEB\\x05\\xE8\\xE6\\xFF\\xFF\\xFF(.*)"; 
    213         mapping (key,key,size); 
     217        mapping (none,size,size,key,post); 
    214218}; 
    215219 
    …… 
    258262        "\\x57\\xF8"; 
    259263 
    260         mapping (port); 
     264        mapping (none,port); 
    261265}; 
    262266 
    …… 
    298302        "\\x30\\x83\\xEC\\x54\\x8D\\x3C\\x24\\x33\\xC0"; 
    299303*/ 
    300         mapping (port); 
     304        mapping (none,port); 
    301305}; 
    302306 
    …… 
    312316        "\\x31\\xFF\\x56\\xD2\\x8B\\xC8\\xFF\\x76\\xBE\\xFF\\x56\\xD6\\xEB\\x9E\\xFF\\x56\\x14"; 
    313317 
    314         mapping (port); 
     318        mapping (none,port); 
    315319}; 
    316320 
    …… 
    326330        "\\x53\\xFF\\x57\\xE4\\x50\\xFF\\x57\\xE8"; 
    327331 
    328         mapping (port); 
     332        mapping (none,port); 
    329333}; 
    330334 
    …… 
    340344        "\\xFF\\x56\\x0C\\x8B\\xC8\\x57\\xFF\\x56\\x2C\\xFF\\x56\\x14"; 
    341345 
    342         mapping (port); 
     346        mapping (none,port); 
    343347}; 
    344348 
    …… 
    363367        "\\x64\\xFF\\xD6\\x52\\xFF\\xD0\\x68\\xEF\\xCE\\xE0\\x60\\x53\\xFF\\xD6\\xFF\\xD0"; 
    364368 
    365         mapping (port);  
     369        mapping (none,port);  
    366370}; 
    367371 
    …… 
    386390        "\\x53\\x53\\x55\\xFF\\x55\\xEC\\x6A\\xFF\\xFF\\x55\\xE0"; 
    387391 
    388         mapping (port); 
     392        mapping (none,port); 
    389393}; 
    390394 
    …… 
    403407        "\\xC7\\x47\\x2C\\x01\\x01\\x00\\x00\\x83\\xC7\\x38\\x93\\xAB\\xAB\\xAB\\x64\\x67\\xA1\\x30\\x00\\x8B" 
    404408        "\\x40\\x0C\\x8B\\x40\\x1C\\x8B\\x00\\xFF\\x70\\x08\\xFF\\x16\\xFF\\xD0\\xEB"; 
    405         mapping (port); 
     409        mapping (none,port); 
    406410}; 
    407411 
    …… 
    544548        "\\xc7\\x02\\x63\\x6d\\x64\\x00\\x52\\x50\\xff\\x57\\xe8\\xc7\\x07\\x02\\x00(..)\\xc7\\x47\\x04" 
    545549        "(....)\\x6a\\x10\\x57\\x53\\xff\\x57\\xf8\\x53\\xff\\x57\\xfc\\x50\\xff\\x57\\xec"; 
    546         mapping (port,host); 
     550        mapping (none,port,host); 
    547551}; 
    548552 
    …… 
    553557        "\\xff\\xd0\\x68(....)\\x66\\x68(..)\\x66\\x53\\x89\\xe1\\x95\\x68\\xec\\xf9\\xaa\\x60\\x57\\xff\\xd6" 
    554558        "\\x6a\\x10\\x51\\x55\\xff\\xd0"; 
    555         mapping (host,port);     
     559        mapping (none,host,port);     
    556560};   
    557561 
    …… 
    576580        "\\xFF\\xD0\\x68\\xE7\\x79\\xC6\\x79\\xFF\\x75\\x04\\xFF\\xD6\\xFF\\x77\\xFC\\xFF\\xD0\\x68\\xEF\\xCE" 
    577581        "\\xE0\\x60\\x53\\xFF\\xD6\\xFF\\xD0"; 
    578         mapping (host,port);     
     582        mapping (none,host,port);     
    579583};   
    580584 
    …… 
    594598        "\\x50\\xFF\\x57\\xEC\\xC7\\x07\\x02\\x00(..)\\xC7\\x47\\x04(....)\\x6A\\x10\\x57\\x53\\xFF\\x57\\xFC" 
    595599        "\\x50\\xFF\\x57\\xF0"; 
    596         mapping (port,host);     
     600        mapping (none,port,host);     
    597601};   
    598602 
    …… 
    612616        "\\x48\\x89\\x5C\\x24\\x4C\\x89\\x5C\\x24\\x50\\x8D\\x44\\x24\\x10\\x54\\x50\\x51\\x51\\x51\\x6A\\x01" 
    613617        "\\x51\\x51\\xFF\\x76\\x30\\x51\\xFF\\x56\\x08\\x53\\xFF\\x56\\x1C\\xFF\\x56\\x0C"; 
    614         mapping (host,port);     
     618        mapping (none,host,port);     
    615619};   
    616620 
    …… 
    625629        "\\x8B\\xFD\\xF3\\xAB\\x5F\\xC7\\x45\\x00\\x44\\x00\\x00\\x00\\x89\\x5D\\x3C\\x89\\x5D\\x38\\x89\\x5D" 
    626630        "\\x40\\xC7\\x45\\x2C\\x01\\x01\\x00\\x00\\x8D\\x45\\x44"; 
    627         mapping (host,port);     
     631        mapping (none,host,port);     
    628632};   
    629633 
    …… 
    646650        "\\x79\\xc6\\x79\\xff\\x75\\x04\\xff\\xd6\\xff\\x77\\xfc\\xff\\xd0\\x68\\xf0\\x8a\\x04\\x5f\\x53\\xff" 
    647651        "\\xd6\\xff\\xd0"; 
    648         mapping (host,port); 
     652        mapping (none,host,port); 
    649653};   
    650654 
    …… 
    672676        "\\xC6\\x79\\xFF\\x75\\x04\\xFF\\xD6\\xFF\\x77\\xFC\\xFF\\xD0\\x68\\xEF\\xCE\\xE0" 
    673677        "\\x60\\x53\\xFF\\xD6\\xFF\\xD0"; 
    674         mapping (host,port); 
     678        mapping (none,host,port); 
    675679};   
    676680 
    …… 
    736740        "\\x00\\xE8\\x9C\\xFE\\xFF\\xFF\\x00\\x00\\x00\\x00(....)(..)\\x77\\x73\\x32\\x5F\\x33\\x32\\x00\\x57" 
    737741        "\\x53\\x41\\x53\\x74\\x61\\x72\\x74\\x75\\x70\\x00\\x73\\x6F\\x63\\x6B\\x65\\x74\\x00"; 
    738         mapping (host,port); 
     742        mapping (none,host,port); 
    739743/*  
    740744 * the first 4 bytes of the transferr are the file size 
    …… 
    746750}; 
    747751 
    748  
     752// taken from shellcode-generic/sch_generic_link_trans.cpp 
     753connectbackfiletransfer::linktransfer 
     754{ 
     755        pattern 
     756        ".*\\x53\\x53\\x68(....)\\x68\\x02\\x00(..)\\x8B\\xD4\\x8B\\xD8\\x6A" 
     757//                         ^^^^->ip             ^^-> port 
     758        "\\x10\\x52\\x53\\xBA\\x63\\x30\\x60\\x5A\\xFF\\xD6\\x50\\xB4\\x02\\x50\\x55\\x53\\xBA" 
     759        "\\x00\\x58\\x60\\xE2\\xFF\\xD6\\xBF(....)\\xFF\\xE5.*"; 
     760//                                           ^^^^-> auth key 
     761        mapping(none,host,port,key); 
     762}; 
     763 
     764 
     765// taken from shellcode-generic/sch_generic_stuttgart.cpp 
     766connectbackfiletransfer::stuttgart 
     767{ 
     768        pattern 
     769        "\\x50\\x50\\x68(....)\\x68\\x02\\x00" 
     770        "(..)\\x8B\\xFC\\x50\\x6A\\x01\\x6A\\x02\\xFF" 
     771        "\\x55\\x20\\x8B\\xD8\\x6A\\x10\\x57\\x53\\xFF\\x55" 
     772        "\\x24\\x85\\xC0\\x75\\x59\\xC7\\x45\\x00(....)" 
     773        "\\x50\\x6A\\x04\\x55\\x53\\xFF\\x55\\x2C"; 
     774        mapping(none,host,port,key); 
     775}; 
     776 
     777 
     778/* 
     779// taken from shellcode-generic/sch_generic_link_bind_trans.cpp 
     780bindfiletransfer::bindlinktransfer 
     781{ 
     782        pattern 
     783        "\\xba\\x83\\x53\\x83\\x00\\xff\\xd6\\x53\\x53\\x53\\x68\\x02\\x00" 
     784        "(..)\\x8b\\xd4\\x8b\\xd8\\x6a\\x10\\x52\\x53\\xba\\x00\\x90" 
     785        "\\xa6\\xc2\\xff\\xd6\\x40\\x50\\x53\\xba\\x7a\\x3b\\x73\\xa1\\xff" 
     786        "\\xd6\\x50\\x50\\x53\\xba\\x10\\xd3\\x69\\x00\\xff\\xd6\\x8b\\xd8" 
     787        "\\x33\\xc0\\x50\\xb4\\x02\\x50\\x55\\x53\\xba\\x00\\x58\\x60\\xe2" 
     788        "\\xff\\xd6\\xbf(....)\\xff\\xe5"; 
     789 
     790        mapping (none,port,key); 
     791}; 
     792*/ 
    749793 
    750794 
    …… 
    777821        "\\x8B\\x40\\x34\\x05\\x7C\\x00\\x00\\x00\\x8B\\x68\\x3C\\x5F\\x31\\xF6\\x60\\x56\\xEB\\x0D\\x68\\xEF" 
    778822        "\\xCE\\xE0\\x60\\x68\\x98\\xFE\\x8A\\x0E\\x57\\xFF\\xE7\\xE8\\xEE\\xFF\\xFF\\xFF(.*\\x00)"; 
    779         mapping (command); 
     823        mapping (none,command); 
    780824}; 
    781825 
    …… 
    790834        pattern 
    791835        ".*(wget.*)$"; 
    792         mapping(command); 
     836        mapping(none,command); 
    793837}; 
    794838 
    …… 
    799843        pattern 
    800844        ".*(curl.*)$"; 
    801         mapping(command); 
     845        mapping(none,command); 
    802846}; 
    803847 
    …… 
    808852        pattern 
    809853        ".*((http|https|ftp):\/\/[@a-zA-Z0-9\-\/\\\.\+:]+).*"; 
    810         mapping (uri); 
    811 }; 
    812  
    813  
    814  
    815 // taken from shellcode-generic/sch_generic_link_trans.cpp 
    816 connectbacklinkfiletransfer::linktransfer 
    817 { 
    818         pattern 
    819         ".*\\x53\\x53\\x68(....)\\x68\\x02\\x00(..)\\x8B\\xD4\\x8B\\xD8\\x6A" 
    820 //                         ^^^^->ip             ^^-> port 
    821         "\\x10\\x52\\x53\\xBA\\x63\\x30\\x60\\x5A\\xFF\\xD6\\x50\\xB4\\x02\\x50\\x55\\x53\\xBA" 
    822         "\\x00\\x58\\x60\\xE2\\xFF\\xD6\\xBF(....)\\xFF\\xE5.*"; 
    823 //                                           ^^^^-> auth key 
    824         mapping(host,port,key); 
    825 }; 
    826  
    827  
    828 // taken from shellcode-generic/sch_generic_stuttgart.cpp 
    829 connectbacklinkfiletransfer::stuttgart 
    830 { 
    831         pattern 
    832         "\\x50\\x50\\x68(....)\\x68\\x02\\x00" 
    833         "(..)\\x8B\\xFC\\x50\\x6A\\x01\\x6A\\x02\\xFF" 
    834         "\\x55\\x20\\x8B\\xD8\\x6A\\x10\\x57\\x53\\xFF\\x55" 
    835         "\\x24\\x85\\xC0\\x75\\x59\\xC7\\x45\\x00(....)" 
    836         "\\x50\\x6A\\x04\\x55\\x53\\xFF\\x55\\x2C"; 
    837         mapping(host,port,key); 
    838 }; 
    839  
    840  
    841 // taken from shellcode-generic/sch_generic_link_bind_trans.cpp 
    842 bindlinkfiletransfer::bindlinktransfer 
    843 { 
    844         pattern 
    845         "\\xba\\x83\\x53\\x83\\x00\\xff\\xd6\\x53\\x53\\x53\\x68\\x02\\x00" 
    846         "(..)\\x8b\\xd4\\x8b\\xd8\\x6a\\x10\\x52\\x53\\xba\\x00\\x90" 
    847         "\\xa6\\xc2\\xff\\xd6\\x40\\x50\\x53\\xba\\x7a\\x3b\\x73\\xa1\\xff" 
    848         "\\xd6\\x50\\x50\\x53\\xba\\x10\\xd3\\x69\\x00\\xff\\xd6\\x8b\\xd8" 
    849         "\\x33\\xc0\\x50\\xb4\\x02\\x50\\x55\\x53\\xba\\x00\\x58\\x60\\xe2" 
    850         "\\xff\\xd6\\xbf(....)\\xff\\xe5"; 
    851  
    852         mapping (port,key); 
    853 }; 
    854  
    855  
     854        mapping (none,uri); 
     855}; 
     856 
     857 
     858 
     859 
     860